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Abstract 

In a recent paper, Jaggi et al. lfT2l . presented a distributed polynomial-time rate-optimal network- 
coding scheme that works in the presence of Byzantine faults. We revisit their adversarial models and 
augment them with three, arguably realistic, models. In each of the models, we present a distributed 
scheme that demonstrates the usefulness of the model. In particular, all of the schemes obtain optimal 
rate C ~ z, where C is the network capacity and z is a bound on the number of links controlled by the 
adversary. 

1 Introduction 

Network coding is a powerful paradigm for network communication. In "traditional" networks, internal 
nodes simply transmit packets that arrive to them (without any substantial change of their content). In 
contrast, when performing network coding, internal nodes of the network are allowed to mix the information 
from different packets they receive before transmitting on outgoing edges. This mixing may substantially 
improve the throughput of a network, it can be done in a distributed manner with low complexity, and is 
robust to packet losses and network failures, e.g., lITl fTTlfTSlfTSl lSl. 

The focus of this paper is network coding for multicast networks (where a single sender wants to trans- 
mit the same information to several receivers), at the presence of Byzantine network faults. A Byzantine 
adversary that may maliciously introduce erroneous messages into a network may be especially disruptive 
when network coding is applied. The simple reason is that any message (including the faulty ones) affect 
all messages on its path to the recipient. Therefore, a single faulty message may contaminate many more 
messages down the line. 

Motivated by the above difficulty, there has been some work on detecting and correcting Byzantine 
faults. We distinguish between computationally unbounded and computationally bounded adversaries. For 
computationally unbounded Byzantine adversaries, error detection was first addressed in 111. This was 
followed by the work of Cai and Yeung |[T8l l2l. who generalize standard bounds on error-correcting codes to 
networks, without providing any explicit algorithms for achieving these bounds. Jaggi et al. ifTTl . consider an 
information-theoretically rate-optimal solution to Byzantine attacks, which however requires a centralized 
design. Finally, a distributed polynomial-time rate-optimal network-coding scheme was recently obtained 
(independently) by Jaggi et al. |[T2l and Koetter and Kschischang |[T4l . Error detection for multicast network 
coding in the presence of computationally bounded Byzantine adversaries was also considered in the past 
llT6l l4l l3l. In these works various authentication schemes are performed at internal nodes of the network. 
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In |[T6l m a centralized trusted authority is assumed to provide hashes of the original packets to each node 
in the network, |f3| obviates the need for a trusted entity under the assumption that the majority of packets 
received at terminal nodes is uncorrupted. 

This paper builds on the scheme of [il2il to obtain distributed polynomial-time rate-optimal network- 
coding schemes in three realistic adversarial models. Our schemes, as well as those of |[T2l assume no 
knowledge of the topology of the network and follow the distributed network coding protocol of fE\. Namely, 
their implementation involves only a slight modification of the source and destination while the internal 
nodes can continue to use the standard protocol of HI. Before we mention our contribution in detail, we 
present a brief description of the adversarial models studied in |[T2l . In the following informal summary, a 
sender named 'Alice' is interested in the transmission of information to a group of receivers named 'Bob' 
over a given network. The Byzantine adversary, 'Calvin', controls some of the links of the network and 
injects erroneous messages into the network in aim to corrupt the communication between Alice and Bob. 
Omniscient adversary model: In this model Calvin is all-powerful and all-knowing, and is limited only by 
the number of links z under his control. |fT2'| obtained a network coding scheme with optimal rate for this 
model of C — 2z, where C is the network capacity. 

Secret channel model: This model allows Alice to send to Bob a short (low rate) secret, which is completely 
hidden from Calvin (who is again all-powerful and all-knowing (excluding the secret), and is limited by the 
number of links z under his control). fl2^ obtained a network coding scheme with optimal rate of C — z for 
this model. Notice that the rate achievable in this model is strictly higher than that in the Omniscient model. 
This secret channel model was originally referred to in |[T2l as the 'shared secret model'. We rename it here 
to secret channel model as the secret shared in this model between Alice and Bob may depend on Alice 's 
message. We elaborate on this point in detail shortly. 

Limited eavesdropping model: The last model, which is the least relevant to our work, limits the number 
of hnks on which Calvin can eavesdrop (it was originally named "limited adversary model" and we rename 
it here for concreteness). In this model |[T2l[T0l obtained a network coding scheme with rate C — z,as long 
as Calvin can eavesdrop on at most C — z links (in addition to the z links under his complete control). 

Our Contribution 

In this work we introduce three additional adversarial models, and give optimal rate efficient distributed 
network-coding schemes in each of the models. As mentioned above, our schemes (as well as those of 111 111 ) 
assume no knowledge of the topology of the network and follow the distributed network coding protocol of 
iSl . Roughly speaking, we obtain an optimal rate of C — z on all the adversarial models described below 
(the optimality of our schemes follow, e.g., from fTTl ). 

Random-Secret Model: The first model we present is the random secret model in which Alice and Bob 
share a short (uniformly distributed) random secret which is completely hidden from Calvin. Calvin is all- 
powerful and all-knowing (excluding the secret), and is limited by the number of links z under his control. 
This model differs from the 'secret channel' model discussed in [123 in the sense that the secret that is shared 
by Alice and Bob is not constructed as a function of Alice's message, but rather is uniformly distributed and 
independent of Alice's message. The independence of the secret shared by Alice and Bob from the actual 
message M being transmitted by Alice has several advantages. This allows Alice and Bob to share their 
secret prior to the act of communicating M. For example, one may consider the scenario where Alice and 
Bob are able to meet (or communicate) in advance and share a large source of completely random bits (such 
as a CD of uniformly generated bits). As long as these bits are unknown to Calvin, they can be used overtime 
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to communicate at high rate over the network (without the need of an additional low rate channel connecting 
Alice and Bob). Moreover, as we will see shortly, communication in this model sets the foundations for 
communicating at high rate in the setting in which Calvin is computationally bounded (more specifically, in 
the symmetric key cryptographic setting). We would like to note that in the scheme of |[T2l for their 'secret 
channel' model, the secret information that Alice and Bob share indeed strongly depends on the message M 
Alice transmits to Bob and hence cannot extend naturally to the examples mentioned above. 

For the random secret model we obtain a network coding scheme with optimal rate of C — z. Our scheme 
is obtained by a transformation of the scheme of |[T2l for the secret channel model. In our proof we do not 
need to get into the finer details of the original scheme and instead observe and exploit a useful property of 
the original secret composition. 

Causal-Omniscient Model: As in the Omniscient model of [12,1 . in this model we assume Calvin is all- 
powerful and all-knowing, and is again limited by the number of links z under his control. However, to 
obtain rate greater than C — 2z, we slightly restrict Calvin. Namely, we assume that Calvin is causal. 
Specifically, when Calvin injects messages into the network at time step t, he only has access to messages 
sent by Alice at time steps at most t + A. Here, A is some parameter of the network which is considered 
small compared with the length of the communication stream. 

We present an optimal rate distributed network coding scheme for this model. Just as in the omniscient 
adversary model, our scheme requires C > 2z. However, in such a case we obtain a rate ofC — z (compared 
with C — 2z in the omniscient adversary model). Our scheme is obtained by a fully modular composition of 
two network coding schemes from |[T2l : one for the omniscient adversary model and the other for the secret 
channel model. The study of the causal-omniscient model will set the foundations for communicating at high 
rate in yet an additional setting in which Calvin is computationally bounded, the public key cryptographic 
setting. 

We would like to note that causal adversaries were also implicitly studied in [ill] in the centralized 
setting, while in this work we focus on the distributed setting. Nevertheless, the upper bounds proven in 
inn imply that the requirement of C > 2z is necessary (otherwise no information can be transmitted). 

Computationally-Bounded Adversary Model: While our previous models did not make any computa- 
tional assumptions on the parties involved, we now turn to study the case in which Calvin is computationally 
bounded (as before Calvin is all-knowing, excluding any secret keys, and limited by the number of links z 
under his control). In this setting, we present two results. The first result uses the notion of symmet- 
ric key cryptography and is based on our random secret model. Roughly speaking, in the case Calvin is 
computationally bounded, one may replace the random secret in the random secret model, by a series of 
pseudo-random bits: bits that would still look completely random (i.e., uniform) to Calvin. Now, to gen- 
erate an (effectively) unlimited amount of shared pseudo-random bits, to be used in several executions of 
the random secret protocol, all Alice and Bob need to do is exchange a single short secret key prior to the 
communication process. This single key, and the bits it generates may be used over essentially unlimited 
time to communicate at high rate. 

The second result addresses the public key cryptographic setting. In this setting, each of the parties, 
Alice and Bob, hold a pair of keys: a private key (known only to itself) and a pubUc key (known to all 
— including Calvin). Encrypted point to point communication between Alice and Bob can be done using 
these public and private keys; without Alice and Bob ever meeting in advance to exchange a shared secret 
key. However, in the model we study, no point to point channel is available - and Alice would like to 
communicate at high rate to Bob over a given network. We present a network coding scheme for the model 
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at hand. Our scheme is based on the scheme we present for the causal-omniscience model, with the sole 
difference that public-key encryption is used to hide some of Alice's information from Calvin. 

As common in the study of cryptographic primitives, both our results are conditional — in the sense 
that they hold assuming that certain cryptographic primitives exist (such as the assumption that factoring is 
hard). Under such assumptions, we prove in the symmetric key setting that our scheme obtains an optimal 
rate of C — z, and in the (weaker) public key setting we obtain the same optimal rate under the condition 
that C > 2z. In this model Calvin is no longer causal, however, as in the causal-omniscient model, it can be 
seen that the upper bounds of ifTTI imply that the latter requirement of C > 2^; is necessary. 

We note that in the public key scenario, we assume that Alice knows Bob's public key. For this reason, 
the public-key model seems particularly suitable in settings where cryptography is already involved (e.g., 
to ensure privacy and integrity of the communication). In such a scenario, a public-key infrastructure may 
already be available and computational limitations on the adversary are usually already assumed. 

The remainder of the paper is organized as follows. Section |2] contains the model definitions and nota- 
tion. Sections [3l|4]and|5]discuss the three new models and schemes presented above. 

2 Preliminaries 

In this section we give the definitions and notation that aie required to model network coding in various 
adversarial models. Our definitions and notation mostly follow |[T2l . 

Network Model The network will be modelled as a graph. We assume our graphs are acyclic, and the 
communication over them is done in a synchronous manner. Namely, in each time step a single packet of 
information can traverse an edge of the network. 

Network-coding schemes We will consider the task of routing information over the network from a single 
sender Alice to multiple receivers Bob (the setting of multicast). In fact, in our analysis, it will usually be 
sufficient to consider a single receiver Bob. The reason is that in the schemes we suggest, neither Alice 
nor the network need to be aware of the location of Bob in the network. Therefore, it will be possible to 
extend each one of our schemes from the case of a single receiver to the case of multiple receivers (this state 
of affairs is common in the study of multicast network coding, e.g. US). We will therefore continue the 
formalization, assuming a single receiver (and will address the setting of multicast separately for each one 
of our schemes). 

We will not assume that Alice, Bob or any other internal node is aware of the network topology or of the 
location of Alice and Bob in the network. The network topology will only influence the maximal achievable 
rate. A network-coding scheme is defined by Alice's encoder, Bob's decoder, and the coding performed in 
internal nodes. We will now discuss those three components. 

Let M be the message Alice wishes to transmit to Bob. The encoding algorithm of Alice adds some 
redundancy into the message, thus obtaining an encoded message X. This information is routed through the 
network, where it is further encoded (as a result of the network coding). Bob receives encoded information 
that may also encompass network faults. Bob's decoding algorithm, applied to the encoded information, is 
supposed to factor out the network faults and retrieve the original message M. 

It is convenient to assume that Alice's encoded message X is represented by a 6 x n matrix, where every 
entry of the matrix is an element from a finite field ¥q. We refer to a column as a slice, to a row as a packet, 
and to each entry as a symbol. It is also useful to note that in all of the schemes of llT2l . as well as ours, X 



4 



is composed of the original message M, and in addition some 5n slices of redundancy. In other words, the 
size of Mis [1-5) that of X. 

The specific coding performed by internal nodes is less relevant to our work, as it is inherited without 
change from llT2ll . For concreteness, let us mention that internal nodes, as well as Alice herself, perform 
random linear network coding a la [8]. Namely, for each of its outgoing links, a node selects random 
coefficients of a linear transformation over Fg (the number of coefficients is h for Alice and equals the 
indegree for any internal node). The network coding of each of the slices of X goes as follows: First Alice 
sends on each of her out-going edges the corresponding linear transformation of the symbols in the slice. 
Whenever an internal node receives a symbol on each of its incoming edges (which is in itself a linear 
transformation of the slice's symbols), it sends on its outgoing edges the corresponding transformation of 
those symbols. As common in the literature of network coding, as our graphs are acyclic, we assume 
that information from different slices is not mixed throughout the communication process. This can be 
established by sufficient memory at internal nodes of the network. 

Adversarial Model Each one of the adversarial models we consider in this paper is specified by the exact 
power of the adversary Calvin. We mention here the common properties of Calvin. 

Calvin has under his control z network's links of his choiceQ On these links Calvin may inject his own 
packets, disguised as part of the information flow from Alice to Bob. Calvin succeeds if Bob decodes a 
message different than Alice's original M. The goal of the network-coding scheme is to ensure this only 
happens with very small probability while maximizing the rate in which information flows from Alice to 
Bob. 

We do not assume that Alice, Bob or any internal node are awaie of the links under Calvin's control. On 
the other hand, Calvin has full knowledge of the network topology as well as the identity of Alice and Bob. 
In all of our models we assume that Calvin has full eavesdropping capabilities (i.e., Calvin can monitor the 
entire communication on each one of the links). Calvin knows the encoding and decoding schemes of Alice 
and Bob, and the network code implemented by the internal nodes (including the random linear coefficients). 
Furthermore, in our proofs, we assume that Calvin selects the message M that Alice transmits. This ensures 
that our schemes work for every message M Alice sends to Bob. 

The network capacity, denoted by C, is the maximum number of symbols that can be delivered on 
average, per time step, from Alice to Bob, assuming no adversarial interference (i.e., the max flow of infor- 
mation from Alice to Bob). The network capacity is known to equal the min-cut from Alice to Bob. (For the 
corresponding multicast case, C equals the minimum of the min-cuts over all destinations.) For a message 
M, the error probability e(M) is the probability that Bob reconstructs a message different from Alice's 
message M. The (maximum) error probability of the encoding scheme is defined to be e = maxjv/{e(Af)} 
(Here the maximization is taken over the message M of Alice). The rate is the number of information 
symbols that can be delivered on average, per time step, from Alice to Bob . In the parameters above, the 
rate equals {1 — 5) -h (recall that 5 is the fraction of redundant slices). Rate R is said to be achievable if for 
any a > and e > there exists a coding scheme of block length n with rate > R — a and error probability 
e < e. 

'The parameter z represents Calvin's power. It is possible to define z as the min cut between Calvin's links and Bob. This is at 
most, but may be strictly smaller than the number of links under Calvin's control. 
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2.1 Building Blocks of our Schemes 

Our network-coding schemes rely on the schemes of |[T2ll . given in two adversarial models: the omniscient 
adversary model and the secret channel model. We discuss those schemes here. 

2.1.1 A scheme in the omniscient-adversary model 

In the omniscient adversary model, we put no restrictions on the knowledge and ability of Calvin (see 
discussion in Section |2l). In this model, |[T2ll gave a distributed polynomial-time scheme ^omn> and proved 
for it the following theorem: 

Theorem 2.1 ( Il2ll ) Aomn achieves a rate of C — 2z, in the omniscient-adversary model, with code- 
complexity 0{{nC)^). 

2.1.2 A scheme in the secret-channel model 

In the secret channel model, we assume that Alice can secretly send Bob a (short) message that is completely 
hidden from Calvin. We put no additional restrictions on the knowledge and ability of Calvin (see discussion 
in Section 121). In this model, |[T2i gave a distributed polynomial-time scheme ^sc> and proved for it the 
following theorem: 

Theorem 2.2 (|12]) Asc achieves a rate of C — z, in the secret-channel model, with code-complexity 
0{nC'^). The communication on the secret channel consists of at most C"^ -\- C symbols. 

In Section [3l we give some more details on the way the secret message is defined in ^sc- 

2.2 Proof techniques: reduction and worst case analysis 

A scheme is said to be (information theoretically) secure against an adversarial entity Calvin, if for any 
behavior of Calvin, Alice is able to communicate her information to Bob (with high probability). Loosely 
speaking, we think of Calvin as an algorithmic procedure, which given certain inputs (such as the network 
topology, Alice's information and the network code applied by the network), computes which edges in the 
network to coiTupt and which error message to transmit. 

There are several proof paradigms that can be used in an attempt to estabUsh the correctness of a given 
coding scheme. In this work, the correctness of our coding schemes will be proven by means of reduc- 
tion. Namely, we build upon the results of |[T2l . and prove that any adversarial entity Calvin that breaks our 
schemes will imply an additional adversary (usually referred to as Calvin') that will not allow communica- 
tion in one of the schemes presented in |[T2ll . 

More specifically, our proofs can be outlined as follows. We first define our coding schemes. We wiU 
then assume for sake of contradiction that they are not secure. As we would like our schemes to be secure 
for any message M of Alice, this will imply the existence of an adversary Calvin that first chooses which 
message M Alice should send to Bob, and then is able to coiTupt the communication of M between Alice 
and Bob. Thinking of Calvin as an algorithmic procedure, we show how to define the additional adversary 
Calvin' — which is a procedure based on Calvin. Finally we show that Calvin' is able to break one of the 
(provably secure) schemes presented in llT2l — this suffices to conclude our proof. 
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3 Random-Secret Model 



The random-secret model is similar to the secret-channel model of |[T2l with the difference that the secret 
information sent from Alice to Bob should be random and independent of Alice's input message M. For- 
mally, we allow Alice to share with Bob a short secret (which is uniformly distributed). This secret will stay 
hidden from Calvin. 

Alice's secret and message encoding in ^sc Recall that ^sc is the scheme presented in llT2l for commu- 
nication in the secret-channel model. We will show how to transform A^c to a comparable scheme which 
works in the random secret model. The only ingredients of ^sc we need to recall is the structure of Alice's 
secret and of Alice's encoder. The encoding of M into X is very simple: We assume that Alice's message 
M is a 6 X {n — b) matrix over Fg. The matrix X is M concatenated with the 6x6 identity matrix, /. 
Namely, X = [MI]. 

Alice's secret message is computed in two steps. She first chooses C parity symbols uniformly at random 
from the field Fg. The parity symbols are labelled r^, for d € {!,..., C}. We denote by R the vector of 
parity symbols. Con^esponding to the parity symbols, Alice's parity-check matrix P is defined as the n x C 
matrix whose {i^j)*^ entry equals (rj)*, i.e., rj taken to the i^^ power. The second part of Alice's secret 
message is the b x C hash matrix H, computed as the matrix product X ■ P. The secret message sent by 
Alice to Bob on the secret channel is composed of both R and H. As n < C, we indeed have a secret of at 
most C'^ + C symbols. 

A useful property of ^sc Note that the vector R of Alice's secret is already uniform and independent 
of the message M. On the other hand, the hash H is a. deterministic function of R and M (given by the 
equation H = X ■ P). Our main observation (which we will prove below) is the following: for almost every 
value of R, when M is uniform then H is uniform as well. Furthermore, it is enough that a small chunk of 
M will be uniform to guarantee the uniformity of H. This suggests the following idea: instead of selecting 
H as a. function of Alice's message, we can select both R and H uniformly at random. Later, Alice can 
tweak the message a bit such that we indeed get H = X ■ P. We continue to formalizing this idea. 

3.1 Defining the new scheme ^rs 

We now show how to transform ^sc into a scheme with comparable performance in the random secret 
model. To define the scheme we now define the random secret, Alice's encoder, Bob's decoding, and the 
coding in internal nodes. 

The random secret The secret shared between Alice and Bob is composed of a length-C vector R over 
Fq and a 6 x C matrix H over Fg. Both are selected uniformly at random (and independently of each other). 

Even though R and H are selected uniformly, their function in is identical to the function of R and 
H in Asc- We therefore use the same notation as given above. In particular, we refer to H as the hash matrix. 
The elements of R are referred to as the parity symbols and denoted r^, for d € {1, . . . , C}. Furthermore, 
we define the corresponding parity-check matrix P as before. 

Alice's encoder We allow Alice to encode a slightly shorter input message M assumed to be 6 x (n—b—C) 
matrix over F^. Alice encodes M into a 6 x n matrix X = [L M I], where L is a 6 x C matrix and / is the 
6x6 identity matrix. The matrix L is defined (arbitrarily) such that H = X ■ P. We show shortly that this 
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system of lineai^ equations (on the elements of L) will have a unique solution with high probability over H 
and P. If this system has no solution or more than a single solution we define L arbitrarily (say, to be the 
all-zero matrix). 

Network coding and Bob's decoder Both the network coding and Bob's decoder are defined in the same 
way as in ^sc 1121 ■ Once Bob decodes a matrix [L M], Bob discards of the b x C prefix L and outputs M. 

3.2 Properties of ^rs 

We now state and prove the properties of that are almost identical to those of ^sc '■ 

Theorem 3.1 Ars is a distributed polynomial-time scheme. Ars achieves a rate ofC — z, in the random- 
secret model, with code-complexity 0{nC'^). The random secret consists of at most C"^ + C symbols. 

Proof: We will prove that the probabiUty that Bob decodes correctly in is almost identical to the 
probability that Bob decodes correctly in ^sc- The theorem will then follow immediately from the definition 
of and from Theorem 12.21 We note that even though Alice is able to send to Bob a little bit less 
information in than in ^sc (specifically, Alice sends h ■ C fewer elements of Fg), the rate in both 
schemes is identical (as we consider the rate as n goes to infinity). 

Let us consider an adversary Calvin that makes fail with probability e. In particular, Calvin may 
chose a message M for Alice to send s.t. with probability e. Bob reconstructs M which is different than M. 
We will define an adversary Calvin' that makes ^sc fail with probability e' > e — C'^jq. This will conclude 
our proof. 

Calvin' is defined as follows. First Calvin' imitates the message selection of Calvin (namely, Calvin' 
uses the message M' Calvin would have chosen given the topology and the code of the network). If Calvin 
sets Alice's input to the message M then Calvin' sets Alice's input to M' = \L M\ where L is a uniformly 
chosen x C matrix. Then Calvin' continues to mimic Calvin, and behaves identically (in particular Calvin' 
sends the same messages as Calvin would on the same corrupted Unks). 

As we see, Calvin' tries to fail ^sc by mimicking an attack of Calvin on the execution of ^rs- The 
success of Calvin's attack on the execution of depends both on the message X = \L M /] transmitted 
by AUce and the secret information i?, H shared by Alice and Bob. Let V be the distribution over triplets 
(i?, iJ, L) obtained when R and H are selected uniformly at random (and independently of each other) and 
the matrix L is defined to satisfy = X • P if a single such L exists, and is defined to be the all-zero matrix 
otherwise. Let A be the set of triplets (72, H., L) on which Calvin's attack succeeds (here we are assuming 
Calvin to be a deterministic adversary, however our analysis extends naturally to the case in which Calvin 
may act based on random decisions also). Namely, the success probability of Calvin can be formalized as 
Pr[A], where the probability is over the distribution V. 

Now consider the success probability of Calvin' on ^sc averaged over messages of the form M' = 
[L M] (where L is chosen at random). As before this probability depends on the message X = [L M I] 
sent by Alice and by the information R, H shared by Alice and Bob. Let V' be the distribution over triplets 
{R, H, L) obtained when R and L are selected uniformly at random (and independently of each other) and 
H is defined to be X • P. Recall that Calvin' mimics the behavior of Calvin, thus Calvin' succeeds on the 
triplet {R,H,L) iff Calvin succeeds on {R,H,L). Hence, the average success probability of Calvin over 
messages of the form M' = [L M] can be formalized as Pr[A], where the probability is now over V'. Notice 
that the subset A of triplets (i?, H, L) is the set used above in the discussion on ^rs- 

In what follows we show that V and V' are almost identical. This will suffice to prove our assertion. 
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Definition 3.2 The event ^^^j on R happens either if one of the parity symbols is selected to be zero or if 
any two of the parity symbols are identical. In other words, f^^^j happens if there exists d € {1, . . . , C} 
such that Td = 0, or if for two distinct d,d' € {1, . . . , C}, we have that = r'^. 



Note that £'bad defined both for V and for V'. In both cases, R is uniformly distributed. Therefore 
Pro[f^^j^(j] = Prx)'[^bad]- Furthermore, it is easy to argue that this probability is at most C'^/q (simply, 
each of the C parity symbols is zero or identical to a previously selected parity symbol with probability at 
most C/q). We are now able to formalize our main observation: 

Lemma 3.3 Conditioned on Sij/^d happening, the two distributions T> and V' are identical. 

Proof: (of lemma) Let us fix any value of M. Let us also fix any value of R such that f^^^d ^'^^ happen. 
We will show that conditioned on every such fixings, the distributions V and V are identical. 

Let us decompose the nxC parity-check matrix P into a C x C matrix V and an (n — C) x C matrix P', 
V 1 

. By the definition of P, the matrix V is the Van der Monde matrix that corresponds 



such that P 



P' 



to the parity symbols in R. Since we assumed that <?bad happen, we have that the parity symbols 

are all distinct and non zero. Therefore V is invertible. 

With this notation, we can rewrite the equation H = X ■ P as follows: 



H =[LM I] 



V 
P' 



L-V + [M I] ■ P'. 



Since we already fixed M and R, we have that [M I] • P' is a fixed matrix, which we will denote as 
H' . We also have that 1/ is a fixed invertible matrix. We denote by its inverse. Now we have that 
H = L-V + H',or alternatively that L = {H - H') ■ V~^. We can conclude that for every value of H 
there is exactly one value of L for which H = X ■ P. We therefore have that the equation H = X ■ P 
forces a one-to-one coiTcspondence between the values of L and the values of H. Therefore, the uniform 
distribution over L induces the uniform distribution over H and vise versa. The lemma follows. ■ 



Recall that we defined A be the set of triplets {R, H, L) on which Calvin's attack succeeds. It follows 
from the lemma that conditioned on £\^^^ not happening, Pr[A] is identical under V and V . Since we 
already argued that Pi'©[f^j^(j] = Pr^)' ["^badl — ll^ '^^'^ conclude that the probability that "f^ad 
not happen and A does happen is at least e — C'^ /q (regardless of whether the probability is taken over V or 
V). We can finally conclude that Calvin' succeeds in failing ^sc with probability at least e — C^/g. ■ 



Tlie case of multicast In the above description of ^rs. we considered for simplicity the case of a single 
Bob. In the setting of multicast, there are two possible scenarios. First, it may be the case that Alice and 
each of the Bobs share the same random secret, ^rs extends to this scenario with no change (simply because 
^rs completely ignores the location of Bob in the network). We now address the more general scenario, 
where Alice may share a different secret with each one of the Bobs. 

Our main observation is that almost all of the information Alice transmits (the matrix X) is independent 
of the random secret. The only part of X that does depend on the secret is the matrix L. This matrix is rather 
small and its size is independent of the block-length n. Therefore to extend to the setting of multicast, 
all we need to do is to have Alice send a different matrix Li for each of the secrets she shares. Since the 
number of Bobs is bounded by the size of the graph, this only results in negligible rate loss. To decode, each 
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one of the Bobs ignores the communication which relates to other secrets and only keeps the communication 
related to his Lj. Bob then decodes exactly as in ^rs. 

It remains to argue that with high probability each one of the Bobs will decode Alice's message M 
con^ectly. Let us consider Calvin's attempt to fail the receiver Bob whose secret con^esponds to the matrix 
Lj. Our previous analysis implies that each one of the matrices Lj for j ^ i we. with high probability 
uniform and independent of both Li and M. Therefore, these additional matrices cannot assist Calvin in the 
attempt to fail this particular Bob. We conclude that each of the receivers will decode correctly with high 
probability, and therefore all of them are likely to decode conectly. 

Remark 3.4 In the above we assumed that the secret shared between Alice and each receiver Bob includes 
the index i, such that L j corresponds to their shared secret. It is possible to avoid this assumption as follows: 
(1) Let the random secret between Alice and Bob also contain a random (almost pair-wise independent) hash 
function gi. Alice augments the message M with gi{M) for all of those hash functions gi. (2) Continue as 
before and have Bob decode according to each of the L^ 's (as now we assume that Bob does not know i 
such that Li corresponds to his secret). Some of these decodings may result in M 7^ M. But with very high 
probability none of the erroneous decodings will be authenticated by a correct hash gi (M) (as for every M 
and M we have that gi{M) is almost uniform and independent of gi{M)). 

4 Causal-Omniscient Model 

Recall that in our model of communication, the columns of the matrix X (namely, each slice of information 
from X) is encoded independently over time. Given the network's latencies (the number of steps it takes for 
a message to traverse the network), we have that while an internal node v sends messages that correspond to 
the t*^ column of X, Alice may already be sending messages that correspond to column t' > t. Therefore, 
in the model in which Calvin can eavesdrop on all links, it inherently has a "pick into the future". Namely, 
when sending messages which correspond to the t*'^ column of X, we assume that Calvin knows all the 
columns of X up to column t + A, where A is some fixed parameter of the network. It is not hard to verify 
that A is at most the size of the edge set E. However, it may be the case that Calvin does not necessarily 
know any later columns of X. This motivates the definition of the Causal-Omniscient model. 

In the Causal-Omniscient model, Calvin has unlimited computational power. He has under his control 
z network links of his choice. On these links Calvin may inject his own packets, disguised as part of the 
information flow from Alice to Bob. We do not assume that Alice, Bob or any internal nodes are aware of 
the links under Calvin's control. On the other hand, Calvin has full knowledge of the network topology as 
well as the identity of Alice and Bob. Calvin has full eavesdropping capabilities (i.e., Calvin can monitor 
the entire communication on each one of the links). Calvin knows the encoding and decoding schemes 
of Alice and Bob, and the network code implemented by the internal nodes (including the random linear 
coefficients). Furthermore, we assume that Calvin knows which message M Alice is sending to Bob. 

The only limitation on Calvin is the following: while Calvin is allowed access to the internal state and 
randomness of all parties, he does not get such access to Alice's state and randomness. Note that such 
a limitation is implicit in all other limited adversarial models considered here and in |fl2lFI The desired 
implication of this limitation for the Causal-Omniscient model is the following: let A be a fixed parameter 
of the network that specifies a bound on the latency of the network. By the discussion above, if Calvin's 

"For example, in the random- secret model, one has to hide the secret-key which is expressed in various computations of both 
Alice and Bob. 
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messages correspond to columns of X up to its t column then we assume that all columns beyond column 
number t + A are hidden from Calvin. 

4.1 The scheme ^co 

We now define the scheme ^co for the Causal-Omniscient model. The scheme is obtained by a completely 
modular composition of two schemes: A scheme ^sc in the secret-channel model, and a scheme ^omn in 
the omniscient-adversary model. See more details on the schemes in Section|2l The idea of the composition 
is simple: first Alice, Bob (and the network) execute ^sc with Alice's input M, but without Alice sending 
the message on the secret channel (simply because a secret channel is not available in this model). Unfor- 
tunately, without the secret message. Bob cannot decode M correctly yet. Therefore, to transmit this secret 
information, we suggest that Alice and Bob execute ^omn with the secret message as Alice's new input. 
Unfortunately, ^omn niay reveal the secret message to Calvin as well. Our simple observation is that as 
long as the secret message is revealed after the execution of Asc ends, it is too late for Calvin to cause any 
harm. Therefore, all that we need (so that ^co works) is for Alice to send A "garbage" columns between 
the executions of ^sc and of >lomn- We turn to a formal definition of ^co^ 

Alice's encoder Alice invokes the encoding and secret generating algorithms of ^sc on her input M. 
Denote by the output of the encoding and S the message to be sent on the secret channel. Now Alice 
invokes an independent execution of the encoding algorithm ^omn on S as input. Denote by Xs the output 
of the encoding. For reasons that will be made clear shortly, Alice encodes a secret S such that Xs will be 
of block length ns = {n/C)^/^ (here n is the block length of our scheme and C is the capacity). Recall, 
that the size of S (and thus the block length of Xs) in the secret channel scheme is independent of n and 
significantly smaller than ns- Hence, such a blowup in the size of Xs can be obtained for example by an 
arbitrary padding of S with irrelevant information. As we will see, this blowup will enable our scheme 
to have a low probability of en^or (without significantly increasing the code-complexity). As ns is much 
smaller than n, our rate remains optimal. Alice's encoder now outputs X = [Xm Xs], where denotes 
the zero matrix with A columns. 

Network coding As in ^sc and ^omn, the network coding is the standard random-linear coding of HI. 

Bob's decoding Bob first uses the decoder of ylomn on the suffix of the communication (which con^e- 
sponds to the columns of Xs)- Denote by S the decoded message. Bob now applies the decoder of Af,c on 
the prefix of the communication (which corresponds to the columns of Xm), with the (relevant parts of the) 
secret message set to S. Bob outputs the decoded message, which we denote by M. 

4.2 Properties of ^co 

We state the parameters obtained by ^co in the following theorem. 

Theorem 4.1 Aco is a distributed polynomial-time scheme. Aco achieves a rate of C — z, as long as 
C > 2z, in the Causal-Omniscient model, with code-complexity 0{nC^). 

Proof: Most of the properties of ^co follow from the related properties of Asc and ^omn> as given by 
Theorems 12.21 and |2. 1 [ The restriction that C > 2z guarantees positive rate for ylomn (as the rate of ^omn 
is C — 2z). Other than that, ^co inherits its rate from ,Asc- There is some loss of rate in Aco (compared with 
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^sc) due to the communication related to the zero columns and to Xg- Nevertheless, this loss is negligible 
as n tends to infinity. The choice of (the block length of Xs), guarantees that the code complexity due 
to both building blocks (^sc and ^omn) will equal 0{nC'^). 

It remains to bound the eiTor probability e of ^co- Obviously, e < ei + e2, where ei is the probability 
that S ^ S while £2 is the probability that S = S but M ^ M. It follows that ei is bounded by the error 
probability of ^omn when applied to messages of block length 715 that corresponds to Xs- In |[T2l this 
error is shown to be vanishing as the block length tends to infinity (note that when n tends to infinity so 
does ns = {n/CY/^). To bound e2 notice that Calvin does not get access to Xs until he is done corrupting 
Xm- Thus £2 is bounded by the eiTor probability of ^sc when applied to messages of block length that 
correspond to As the block length of Xm is proportional to n, we conclude our assertion. ■ 

Remark 4.2 While we described ^co for the case of a single Bob, it also applies with no change to the 
setting of multicast (simply because ^co completely ignores the location of Bob in the network, and there 
is nothing that distinguishes one Bob from the other). 

5 Computationally-Bounded Adversary Model 

In this section we consider a limitation of a different flavor on the strength of the adversary Calvin. Namely, 
we assume that Calvin is computationally bounded. Assuming so allows us to employ powerful crypto- 
graphic tools. The two results in this section correspond to cryptographic tools that are applicable in two 
different settings: (1) Symmetric-key cryptography (discussed in Section |5?T]) . and (2) Public-key cryptog- 
raphy (discussed in Section [5^ . As common in the study of cryptographic primitives, both our results are 
conditional — in the sense that they hold assuming that certain cryptographic primitives exist (such as the 
assumption that factoring is hard). 

Note that apart from the computational limitations on Calvin his powers are intact. In particular, Calvin 
has full eavesdropping capabilities and has full knowledge of the network topology as well as the identity of 
Alice and Bob. Calvin knows the encoding and decoding schemes of Alice and Bob, and the network code 
implemented by the internal nodes (including the random linear coefficients). 

5.1 Symmetric-key cryptography 

Recall our scheme in the random secret model. Assuming that Alice and Bob share a short random 
secret, this scheme allows them to communicate a significant amount of information which is specified by 
the block length n. Unfortunately, Bob will only be able to decode Alice's message after receiving the entire 
block of communication. Therefore, it is natural to assume that every time slot (e.g., every hour or every 
day, depending on the rate of communication), Alice and Bob would like to terminate the previous execution 
of ^rs and to start a new execution. Let Si, S2, ■ ■ ■ S^he. the sequence of secrets used in these executions. 
In general, the secrets should be independent of each other, which implies that AMce and Bob may need to 
share a long secret if they communicate over a long period of time. 

In the Computationally-Bounded Adversary model, Alice and Bob can execute ^^rs many times while 
still only exchanging a short random string s. For that purpose, Alice and Bob may use a pseudorandom 
generator. For a definition and thorough discussion of pseudorandom generators see ||5|. Essentially, an 
efficiently computable function G is a pseudorandom generator, if (1) G is length increasing (i.e., for every 
input its output is longer than its input) and (2) G{x) is computationally indistinguishable from a uniform 
string, as long as x is uniformly distributed. In other words G{x) is effectively random. It is known that 
the existence of pseudorandom generators is essentially the minimal cryptographic assumption (as it is 
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equivalent to the assumption that one-way functions exist). A pseudorandom generator that expands the 
length of its input implies a pseudorandom generator with arbitrary polynomial expansion (again, the reader 
is referred to 121 for a detailed discussion and references therein). 

The relation to our context is now simple: Alice and Bob can exchange a single short secret key s prior 
to the communication process. Applying a pseudorandom generator to this single key, they can obtain many 
pseudorandom keys G{s) = 5*1, 5*2, . . . , S'^ to be used in repeated executions of Ars (in fact, £ need not be 
known in advance as it is possible to keep on expanding G's output on the fly). The proof that such repeated 
executions of ^rs ai"e still secure is rather immediate from the definition of a pseudorandom generator and 
we therefore only sketch it here. For any i, if Si is truly random Calvin will fail the execution of ^rs with 
very small probability. Assume for the sake of contradiction that this is not the case when Si is taken from 
the output of G. This gives a way to distinguish the output of G from random. The distinguisher simply 
simulates the repeated execution of (playing the roles of Alice, Bob, internal nodes, and Calvin). Now 
if Calvin succeeds then the distinguisher can deduce with non-negligible probability that Si is not truly 
random. 

Remark 5.1 As discussed in Section [3l the scheme can be extended to the case of multicast. The idea 
described here, of replacing the random keys in multiple executions of ^rs with pseudorandom keys, applies 
in the setting of multicast as well (in that setting, Alice and each one of the Bobs will share a short key that 
will be expanded to many pseudorandom keys using the pseudorandom generator). 

5.2 Public-key cryptography 

A disadvantage of the scheme Ars is that Alice and Bob need to shai^e a common key. In this section we 
relax this set up requirement and only ask that Bob holds a pair of keys: a private key (known only to 
itself) and a public key (known to all — including Calvin). In such a setup, without Alice and Bob ever 
meeting or exchanging private information, we are able to give a network-coding scheme, A^-^, against 
a computationally-bounded Calvin with very similar pai'ameters to those of ^co (which was given in the 
Causal-Omniscient model). 

5.3 The scheme ^pj^ 

We present a network coding scheme, A^^, for the public -key model, that is very similar to our scheme 
for the Causal-Omniscient model. Again, we compose two schemes: A scheme ^sc in the secret-channel 
model, and a scheme ^omn in the omniscient-adversary model. (See more details on the schemes in Sec- 
tion|2l) Alice, Bob (and the network) execute ^sc with Alice's input M, but without Alice sending the secret 
message S on the secret channel (simply because a secret channel is not available in this model). We would 
like to execute y^omn with S as Alice's new input. Unfortunately, as in this model all of the information sent 
by Alice (i.e., the matrix X in its entirety) is known to Calvin from the start, S will be available to Calvin 
during the execution of ^sc and the scheme may fail. The solution is simple: instead of sending 5, Alice 
will first encrypt S using Bob's public key, and send the encryption to Bob using ^omn- We now describe 
our scheme and proof in more detail. 

Public-key encryption A central ingredient in building ^pj, is a public-key encryption (PKE) scheme. 
For a thorough discussion of public-key encryptions see 13. We describe here the relevant definitions for 
completeness. 



13 



A PKE scheme gives a way for two parties to communicate securely even though they did not previously 
meet and exchange secrets. The scheme is composed of three probabilistic polynomial time algorithms - the 
key generating algorithm Gen and the encryption and decryption algorithms Enc and Dec: (1) The input of 
Gen is the security pai^ameter k (we will shortly discuss the role of k), and its output is a pair of keys - the 
secret key sk and the public key pk (both are of length polynomial in k). (2) The public key pk (which is 
known to everyone) is used for encryption. The encryption of a message m is a ciphertext y = Enc{pk, m). 
The plaintext m may be of arbitrary length and the length of y is polynomial is the length of m and in k. (3) 
The secret key sk allows decryption. For every y as above we have that Dec{sk, y) = m. 

The security requirement from a PKE scheme is that a ciphertext y gives no information on the plain- 
text m to a computationally bounded adversary. More formally, we will use a PKE scheme which is 
semantically-secure against chosen-plaintext attack (CPA) ITJ. H There are various equivalent formaliza- 
tions of this security requirement and the one that seems most convenient for us is based on the notion of 
indistinguishability. Loosely, this means that no efficient adversary Adv can distinguish an encryption of 
a message niQ from an encryption of a message mi, (where Adv is also allowed to select niQ and mi). 
In other words, given an encryption y = Enc{pk,nifj), where o" is a uniformly selected bit, an adversary 
cannot guess a with probability significantly better than half. This is exactly where the security parameter k 
comes into play: the advantage over half of the adversary in guessing a is smaller than l/poly{k) for every 
polynomial poly (under stronger assumptions we may require the advantage to be exponentially small in k). 

We are now ready to define ^pj, formally. 

Security parameter In this model, the network coding scheme is defined per security parameter k. This 
parameter should be chosen as to make the encryption scheme {Gen, Enc, Dec) secure enough. As the 
errors we seek are of the order of 1/n, it is enough to take /c < for some small constant a > (under 
stronger assumptions, k may even be logarithmic in n). This will imply that all the ciphertexts used in our 
scheme aix of negligible length compared with n (e.g. smaller than n°^ for any a' > of our choosing). 

Bob's keys Bob runs Gen and gets as output the pair {sk,pk). Bob publishes pk as his public key and 
saves his secret key sk. 

Alice's encoder Alice invokes the encoding and secret generating algorithms of ^sc on her input M. 
Denote by Xm the output of the encoding and S the message to be sent on the secret channel. Alice invokes 
Enc{pk, S) and gets as output Y . Now Alice invokes (using fresh randomness) the encoding algorithm of 
-4.omn on Y as input. Denote by Xs the output of the encoding. Alice now outputs X = [Xm Xs\- As in 
SectionHlwe will pad Xs if necessary to ensure that it has block length ns = {n/G)^/^. 

Network coding As in ^sc and ^omn» the network coding is the standard random-linear coding. 

Bob's decoding Bob first uses the decoder of ylomn on the suffix of the communication (which con^e- 
sponds to the columns of Xs)- Denote by Y the decoded message. Bob invokes Dec{sk, Y), and receives 
S as output. Bob now applies the decoder of ^sc on the prefix of the communication (which corresponds to 
the columns of Xm), with the secret message set to S. Bob outputs the decoded message, which we denote 
by M. 

^In Remark [53] we note that in some cases one may choose to require security against chosen-ciphertext attack (CCA security). 
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5.4 Properties of ^pj^ 

We state the parameters obtained by ^pj^ in the following theorem. 

Theorem 5.2 Apj^ is a distributed polynomial-time scheme. achieves a rate of C — z, as long as 

C > 2z, in the public-key model, with code -complexity 0{nC'^). 

Proof: Similar to the proof of Theorem l4.1[ most of the properties of A^y^ follow from the related properties 
of ^sc and ^omn> as given by Theorems 12.21 and |2 . 1 1 

It remains to bound the error probability e of ^pj^. Obviously, e < ei + €2, where ei is the probability 
that Y while £2 is the probability that F = F but M / M. As in the proof of Theorem |4?T] it is 
not hard to argue that ei is bounded by the error probability of ^omn (when applied to messages of block 
length ns). We would now Uke to argue that €2 is bounded by the error probability of ^sc (when applied to 
messages of block length corresponding to Xm)- This will turn out to be correct up to a negligible additional 
error (which relates to the security property of the PKE scheme). 

To bound €2 we must argue that Calvin cannot use the encryption 1" of S" to increase his probability 
of corrupting the communication between Alice and Bob. Intuitively, this is clear - as the encryption S is 
computationally sound. However, to prove our argument formally, we need to present our claim under the 
sole assumption that our encryption is secure against a chosen-plaintext attack. To this end, we condition on 
the fact that Y = Y (and hence Bob knows S) and show that a successful Calvin in our setting will imply 
a successful Calvin in an imaginary setting in which Bob is given 5 (e.g., via a side channel) and the value 
of Xs transmitted over the network is the encoding of an all zero message. This in turn, implies that Calvin 
can corrupt the original secret-channel protocol ^sc of |[T2l . a contradiction. We now sketch the details. 

Let Calvin be an adversary that causes Y = Y and M 7^ M in an execution of A^-^, with probability €2- 
As a mental experiment assume that Bob's decoder receives S as an additional input. Bob can then ignore Y 
and simply invoke the decoder of ^sc- In this experiment we have that the probability that Calvin manages 
to cause Y = Y but M ^ M is still €2- This follows immediately from the properties of a PKE scheme (as 
if y = y we also have that S = S). 

Further revising this mental experiment, let us now assume that Alice defines Y as the encryption of the 
zero-message (or any other fixed message), rather than the encryption of S. It is not hard to argue that in 
this case, the probability that Calvin causes M 7^ M is at least €2 — neg{k) where neg{-) is some negligible 
function (that is asymptotically smaller than l/poly{-) for every polynomial poly{-)). If this is not the case 
then we can easily devise an adversary Adv that breaks the security of the PKE scheme. Adv will simulate 
all parties of the network-coding scheme (Alice, Bob, Calvin and the internal nodes). When Alice generates 
S then Adv will set nii = S and will set mo to be the all-zero message. Adv then receives y which is an 
encryption of one of these messages. Adv can now continue the simulation of the network-coding scheme 
with Y = y. Finally, when the simulation is over, Adv will output one if M 7^ Af and zero otherwise. 

Summing up, we have an adversary Calvin that causes M ^ M with probability e'g = e2 — neg{k), in the 
revised mental experiment based on ^pj^. Note that in this mental experiment Xs is completely independent 
of S. Therefore, it is possible to define an adversary Calvin' that fails ^sc with probability 62 by simulating 
the attack of Calvin in the setting of the mental experiment. The theorem therefore follows. ■ 

Remark 5.3 In the definition of ^pj, we used a PKE scheme which is secure against a chosen-plaintext 
attack. We proved that one invocation of Ap^ works when the public-key is only used for this invocation. 
In case the same public-key is used many times, and especially if it used for messages sent from different 
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senders it may be safer to use a PKE scheme that is secure against a chosen-ciphertext attack (see lH for 
more information). 

The case of multicast In the above description of ^pj^, we considered for simplicity the case of a single 
Bob. The scheme can be extended to the setting of multicast, in a similar manner to the extension of ^rs 
to multicast (see discussion in Section [3]). In fact the extension is a bit simpler in the case of as we 
describe now. 

We assume that the Tth receiver knows a pair consisting of a secret key ski and public key pki. The 
public key is known to everyone including Alice. Now, for every i, Alice will transmit (using ^omn) the 
pair {pki, Yi), where Yi = Enc{pki, S) (recall that in the basic scheme, Alice transmits a single Y). Based 
on the properties of ^omn we can assume that each of the Bobs correctly retrieves all of the pairs. The 
ith receiver can decode Yi (which corresponds to its public key pki) and continue the decoding of M as in 
the basic scheme. To argue that with high probability each one of the Bobs will decode Alice's message 
M correctly, we note that the concatenation of all the different encryptions of S still does not reveal any 
information on S. 

6 Conclusions 

In this paper we have introduced three adversarial models and have argued that (1) The models may be 
realistic. (2) The models are useful in the sense that they allow non-trivial improvements in the parameters of 
network coding schemes. We feel that this calls for more attention into the assumptions regarding adversarial 
limitations and set-up assumptions that apply in "real life" scenarios. Are the models suggested here indeed 
applicable? Are there any other realistic and useful models to consider? 
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